commandmate 0.31.2 → 0.32.0

package/dist/server/src/lib/detection/tools/antigravity/dialog.js

@@ -0,0 +1,239 @@
+"use strict";
+/**
+ * Antigravity (agy)'s numbered permission dialogs, read on their own terms
+ * (Issue #2364).
+ *
+ * ## What was measured (agy 1.1.27, pane 200x1000, 2026-09-06)
+ *
+ * `tests/fixtures/antigravity-live-2364/` holds the frames. The two that this
+ * module exists for:
+ *
+ * | frame                     | question                        | options | shape                              |
+ * |---------------------------|---------------------------------|---------|------------------------------------|
+ * | `dialog-create-file.txt`  | `Allow creation of this file?`   | 2       | diff preview above the question    |
+ * | `dialog-bash-wrapped.txt` | `Do you want to proceed?`        | 4       | options 2 and 3 wrap onto 3 rows   |
+ *
+ * Before this Issue the first resolved as `antigravity_selection_list`
+ * (`hasActivePrompt: false`, so the chat surface drew an arrow pad and no
+ * yes/no panel) because Issue #2270's discriminator was the sentence `Do you
+ * want to proceed?`; the second passed the discriminator and then failed in the
+ * generic multiple-choice parser, which reads one row per option, so the
+ * `esc to cancel` status row fell through to the thinking pattern and the pane
+ * was published as `running` / `thinking_indicator` — "generating", with `wait`
+ * never returning. agy prints the command text inside the option label, so
+ * every Bash approval of a multi-line command takes the second shape.
+ *
+ * ## What this reads
+ *
+ * The block between the nearest boundary row and the `↑/↓ Navigate` footer
+ * ({@link locateAntigravityDialogRegion}), through the shared
+ * {@link findNumberedOptionBlock}: a run of `N. label` rows descending to `1.`,
+ * every non-numbered row folded into the label above it, the `>` gutter naming
+ * the highlighted option. The question is the one `?`-terminated row directly
+ * above option 1 — NOT the five rows the generic parser joins, which on the
+ * file-creation menu put the diff preview into the question
+ * (`…hello-agy.txt +1 1 + hello from antigravity Allow creation of this file?`).
+ * The diff, the command and the panel header go to `instructionText`, where the
+ * prompt panels render them as context.
+ *
+ * ## Who calls it
+ *
+ * Every producer of the wire, so that they cannot disagree about one screen:
+ * `antigravity/detect.ts` (the status verdict `/current-output` publishes),
+ * `polling/response-checker.ts` (`detectPromptOnCleanFrame` — the `prompt` row
+ * the poller stores, the push notification it raises, AND the Auto-Yes poller's
+ * reading) and the `prompt-response` route's re-verification.
+ *
+ * Issue #2364 left the Auto-Yes poller on the generic pass, on the premise that
+ * agy's `PreToolUse` hook answers the permission request before the dialog is
+ * drawn. Measured false (#2368): agy 1.1.27 ignores a hook `allow` in
+ * interactive mode and draws the dialog anyway (#1779), so agy's Auto-Yes
+ * depends entirely on this TUI reading — and without it every wrapped Bash
+ * approval sat unanswered while `/current-output` published it as waiting.
+ * #2368 put that poller on the same entry.
+ *
+ * Deliberately NOT a change to the generic multiple-choice parser: folding
+ * continuation rows there would change what every other tool's dialogs read
+ * as, and each of those readings is pinned to its own live captures.
+ *
+ * ## Input contract
+ *
+ * ANSI-stripped text; box drawing optional (the poller's copy has been through
+ * `stripBoxDrawing`, the status path's has not, and the block is bounded the
+ * same way on both — see {@link ANTIGRAVITY_DIALOG_BOUNDARY_PATTERN}).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readAntigravityNumberedDialog = readAntigravityNumberedDialog;
+exports.detectAntigravityNumberedDialogPrompt = detectAntigravityNumberedDialogPrompt;
+const cli_patterns_1 = require("../../cli-patterns");
+const prompt_detect_multiple_choice_1 = require("../../prompt-detect-multiple-choice");
+const tui_detection_frame_1 = require("../../tui-detection-frame");
+const dialog_block_1 = require("../dialog-block");
+/**
+ * How many non-blank rows above option 1 may be searched for the question.
+ *
+ * On every measured frame the question is the row directly above option 1;
+ * the allowance is for a blank row or a wrapped question, not for reaching up
+ * into the diff preview.
+ */
+const QUESTION_SCAN_ROWS = 3;
+/**
+ * How far above the question the panel header may sit.
+ *
+ * The `●` tool-call row that opens the panel is what `instructionText` starts
+ * under; the cap keeps a frame with no such row from carrying the whole
+ * transcript into the panel text.
+ */
+const INSTRUCTION_LOOKBACK_ROWS = 40;
+/**
+ * How many non-blank rows under the bottom option row may be its wrapped tail.
+ *
+ * Handed to {@link findNumberedOptionBlock} as its footer scan, because the
+ * region this reader hands it ends above the real footer. Sized well past the
+ * three-row labels agy 1.1.27 draws; a command long enough to exceed it is
+ * elided by agy itself (`pr...'`).
+ */
+const LAST_OPTION_TAIL_ROWS = 12;
+/** The `●` tool-call row that opens every measured agy permission panel. */
+const TOOL_CALL_ROW_PATTERN = /^\s*●\s/;
+/** A horizontal rule; dropped from `instructionText`, where a 200-column rule is noise. */
+const RULE_ROW_PATTERN = /^\s*─{3,}\s*$/;
+/** A row that asks something — the shape the question row takes on every measured dialog. */
+const QUESTION_ROW_PATTERN = /[?？]\s*$/;
+/**
+ * The same tail limits `prompt-detector.ts` applies to `rawContent`
+ * (`RAW_CONTENT_MAX_LINES` / `RAW_CONTENT_MAX_CHARS`), restated because that
+ * helper is private to it. A prompt row stores this text as its message body,
+ * so an unbounded 1000-row pane must not go in.
+ */
+const RAW_CONTENT_MAX_LINES = 200;
+const RAW_CONTENT_MAX_CHARS = 5000;
+function truncateRawContent(content) {
+    const lines = content.split('\n');
+    const tail = lines.length > RAW_CONTENT_MAX_LINES ? lines.slice(-RAW_CONTENT_MAX_LINES) : lines;
+    const joined = tail.join('\n');
+    return joined.length > RAW_CONTENT_MAX_CHARS ? joined.slice(-RAW_CONTENT_MAX_CHARS) : joined;
+}
+/**
+ * Read agy's numbered dialog off ANSI-stripped rows.
+ *
+ * Null when the frame has no `↑/↓ Navigate` footer, when the rows above it do
+ * not form a numbered run reaching `1.` (the Switch Model picker, the trust
+ * screen, the slash popup), or when the block sits under a `Switch Model`
+ * header. A caller that has already passed `isAntigravityNumberedDialog` and
+ * still gets null here is looking at a numbered dialog this reader cannot
+ * parse — which is an unclassified frame, not a picker.
+ */
+function readAntigravityNumberedDialog(lines) {
+    const region = (0, cli_patterns_1.locateAntigravityDialogRegion)(lines);
+    if (region === null)
+        return null;
+    const regionRows = lines.slice(region.start, region.footer);
+    if (regionRows.some(row => cli_patterns_1.ANTIGRAVITY_SWITCH_MODEL_HEADER_PATTERN.test(row)))
+        return null;
+    // The slice stops ABOVE the footer row, so the rows the block reader files
+    // as `footer` — the non-option rows between the bottom option and the region
+    // end — are the wrapped tail of the LAST option, not chrome: agy 1.1.27 draws
+    // `6. No, and always deny for commands that start with '<cmd>` over three
+    // rows on a repeated denial (`dialog-bash-wrapped-six.txt`), and the
+    // `↑/↓ Navigate` footer this region is anchored on already vouched for the
+    // block. Every other row of the region above the block is question / preview
+    // and never reached (the run stops at `1.`).
+    const block = (0, dialog_block_1.findNumberedOptionBlock)(regionRows, regionRows.length, LAST_OPTION_TAIL_ROWS);
+    if (block === null)
+        return null;
+    const options = [...block.options];
+    if (block.footer !== '') {
+        const last = options.length - 1;
+        options[last] = [options[last], ...block.footer.split('\n')].join(' ').trim();
+    }
+    const firstOptionRow = region.start + block.firstRow;
+    // The question: the nearest `?`-terminated row above option 1, looking past
+    // blank rows and at most QUESTION_SCAN_ROWS non-blank ones, none of which
+    // may be a boundary (that would be the previous turn, not this panel).
+    let questionRow = -1;
+    let fallbackRow = -1;
+    let scanned = 0;
+    for (let i = firstOptionRow - 1; i >= region.start && scanned < QUESTION_SCAN_ROWS; i--) {
+        const row = lines[i];
+        if (row.trim() === '')
+            continue;
+        if (cli_patterns_1.ANTIGRAVITY_DIALOG_BOUNDARY_PATTERN.test(row) || RULE_ROW_PATTERN.test(row))
+            break;
+        scanned++;
+        if (fallbackRow < 0)
+            fallbackRow = i;
+        if (QUESTION_ROW_PATTERN.test(row)) {
+            questionRow = i;
+            break;
+        }
+    }
+    if (questionRow < 0)
+        questionRow = fallbackRow;
+    return {
+        question: questionRow < 0 ? 'Please select an option:' : lines[questionRow].trim(),
+        options,
+        selectedIndex: block.selectedIndex,
+        questionRow: questionRow < 0 ? firstOptionRow : questionRow,
+        firstOptionRow,
+        footerRow: region.footer,
+    };
+}
+/**
+ * The panel text above the options, for the prompt panels' context box.
+ *
+ * From the row under the `●` tool-call row that opened the panel (`Command`,
+ * `Create file`, the `Requesting permission for:` block, the diff preview),
+ * through the question, the options and the footer — rules dropped. Falls back
+ * to the dialog region when no tool-call row is within reach.
+ */
+function extractInstructionText(lines, dialog) {
+    const region = (0, cli_patterns_1.locateAntigravityDialogRegion)(lines);
+    let start = region?.start ?? dialog.questionRow;
+    const floor = Math.max(0, dialog.questionRow - INSTRUCTION_LOOKBACK_ROWS);
+    for (let i = dialog.questionRow - 1; i >= floor; i--) {
+        if (TOOL_CALL_ROW_PATTERN.test(lines[i])) {
+            start = i + 1;
+            break;
+        }
+    }
+    const text = lines
+        .slice(start, dialog.footerRow + 1)
+        .filter(row => !RULE_ROW_PATTERN.test(row))
+        .map(row => row.trimEnd())
+        .join('\n')
+        .trim();
+    return text.length > 0 ? text : undefined;
+}
+/**
+ * Read agy's numbered dialog as the `multiple_choice` prompt the rest of the
+ * system consumes, or null when the frame does not carry one.
+ *
+ * The result has the same shape `detectPrompt` produces for a numbered dialog
+ * — `promptData.type === 'multiple_choice'`, `options[].isDefault` on the
+ * highlighted row, `instructionText` / `approvalTarget` / `rawContent` filled
+ * the way Issues #235 and #1699 defined them — so `PromptPanel`,
+ * `MobilePromptSheet`, `respond`, the deny patterns and the prompt-history
+ * writers all read it unchanged.
+ *
+ * @param text - ANSI-stripped capture, box drawing optional
+ */
+function detectAntigravityNumberedDialogPrompt(text) {
+    const normalized = (0, tui_detection_frame_1.normalizeTuiFrameForDetection)(text);
+    const lines = normalized.split('\n');
+    const dialog = readAntigravityNumberedDialog(lines);
+    if (dialog === null)
+        return null;
+    return (0, prompt_detect_multiple_choice_1.buildMultipleChoiceResult)(dialog.question, dialog.options.map((label, index) => ({
+        number: index + 1,
+        label,
+        isDefault: index === dialog.selectedIndex,
+    })), {
+        instructionText: extractInstructionText(lines, dialog),
+        // Issue #1699's machine-facing surface: bounded above at the previous
+        // turn's boundary and below at the footer, so the command in the
+        // `Requesting permission for:` block and in the labels is judged and
+        // nothing from an earlier, already-answered approval is.
+        approvalTarget: (0, prompt_detect_multiple_choice_1.joinApprovalTarget)(lines, (0, prompt_detect_multiple_choice_1.findApprovalContextStart)(lines, dialog.questionRow), dialog.footerRow),
+    }, normalized, truncateRawContent);
+}

package/dist/server/src/lib/detection/tools/command-code/detect.js

@@ -55,6 +55,13 @@
  * numbered-response path, because Command Code fires `PreToolUse` AFTER the
  * dialog is answered, so a hook-driven permission decision cannot dismiss it.
  *
+ * Issue #2369 added a second `afterPrompt` branch for the other screen the
+ * shared chain could not read: the `/usage` panel, whose last row is
+ * `Press Esc to close`. It is not a picker — nothing moves, nothing commits —
+ * so it gets a reason of its own rather than the selection-list token, and the
+ * chat surface answers it with the one key it accepts. See
+ * `STATUS_REASON.COMMAND_CODE_DISMISSABLE_PANEL`.
+ *
  * `afterPrompt` arrived with Issue #2297, for the one screen the shared chain
  * genuinely could not read: the picker `/model` opens. It is a provider-grouped
  * list of model NAMES — no option numbers — over a `› Type to search models...`
@@ -106,6 +113,32 @@ exports.commandCodeStatusDetector = (0, run_detection_1.createToolStatusDetector
     tool: 'command-code',
     verifiedAgainst: exports.VERIFIED_AGAINST,
     afterPrompt(frame) {
+        // Issue #2369. `/usage` opens a READ-ONLY panel: a plan header, two usage
+        // meters, a breakdown URL, and `Press Esc to close` as its last row. It is
+        // matched before the picker footer below because the two are mutually
+        // exclusive sentences and this one is the more specific — a whole row that
+        // offers a dismiss and nothing else.
+        //
+        // `waiting` rather than `running`, which is the half of this branch that
+        // fixes the reported defect: `isUnclassifiedFrame` (`session/status-evidence`)
+        // is `status === 'running' && <floor reason>`, so a `waiting` verdict takes
+        // `isUnclassifiedActive` down with it and the chat surface stops answering
+        // an eighteen-button card to a one-key panel. The reason is deliberately NOT
+        // in `SELECTION_LIST_REASONS`: there is no highlight here, so the arrow pad
+        // would be as wrong as the answer keys were. `current-output-builder`
+        // publishes it as `isDismissablePanelActive` instead.
+        //
+        // A human still has to press the key, so `waiting` is also the honest word:
+        // nothing on this pane will move until they do.
+        if (selection_shape_1.DISMISSABLE_PANEL_FOOTER_PATTERN.test(frame.lastLines)) {
+            return {
+                status: 'waiting',
+                confidence: 'high',
+                reason: status_reason_1.STATUS_REASON.COMMAND_CODE_DISMISSABLE_PANEL,
+                hasActivePrompt: false,
+                evidence: 'positive',
+            };
+        }
         // Issue #2297. Command Code's pickers (`/model` measured live on v1.40.1 at
         // 200x1000) are arrow-driven overlays with a search box and a lower-case
         // hint-bar footer. Nothing in the shared chain reads that footer, so before

package/dist/server/src/lib/detection/tools/verified-against.js

@@ -74,35 +74,35 @@ exports.OPENCODE_VERIFIED_AGAINST = {
     paneGeometry: '80x200',
 };
 /**
- * agy these rules were read off (#988 / #995 footer + selection rules, re-read
- * against the #2270 live panes).
+ * agy these rules were read off (#988 / #995 footer + selection rules, #2270's
+ * numbered-dialog carve-out, re-measured and re-captured by #2364).
  *
- * Bumped from `0.4.x` / `2026-07-30` / `inline` because the frames were
- * RE-CAPTURED, not because the binary moved: #2270 drove agy 1.1.25 on a private
- * tmux socket at the production geometry and kept both panes inline in
- * `tests/unit/status-detector-selection.test.ts`
- * (`AGY_1125_PERMISSION_PANE`, `AGY_1125_SWITCH_MODEL_PANE`) under the banner
- * `Antigravity CLI 1.1.25`, trailing pane padding included. The
- * `Do you want to proceed?` + `N. label` rules were measured off those frames,
- * and `ANTIGRAVITY_SELECTION_LIST_PATTERN` (#995 / #997) was re-checked against
- * them and left unchanged.
+ * Bumped from 1.1.25 because the frames were RE-CAPTURED and the rules CHANGED:
+ * #2364 drove agy 1.1.27 on a private tmux socket at the production geometry and
+ * kept the frames in `tests/fixtures/antigravity-live-2364/` — the file-creation
+ * menu (`Allow creation of this file?`, two options), the Bash approval whose
+ * option labels wrap onto three rows each, the one-row Bash approval #2270 had
+ * measured on 1.1.25, the `/model` picker, the folder-trust screen, the
+ * slash-command popup, and the first live IDLE agy frame. The numbered-dialog
+ * discriminator (`isAntigravityNumberedDialog`) was rewritten off those frames
+ * from a question-line match to the footer + numbered-row structure, and the
+ * dialogs are now read by `tools/antigravity/dialog.ts` rather than by the
+ * generic multiple-choice parser. `ANTIGRAVITY_SELECTION_LIST_PATTERN`
+ * (#995 / #997) was re-checked against every frame and left unchanged.
  *
- * `paneGeometry` leaves `inline` because the 1.1.25 permission dialog draws no
- * composer row at all — it reproduces only at the 200x1000 pane the server
- * captures, and a fixture without the ~970 blank padding rows exercises a
- * different `lastLines` slice than production does. That is a statement about
- * the capture condition, not about agy: the scrollback-retained rendering the
- * `afterThinking` footer rules rest on (#988) is unchanged, and the 1.1.25
- * dialog still ends on `esc to cancel`.
+ * The #2270 1.1.25 panes stay where they are
+ * (`tests/unit/status-detector-selection.test.ts`) and the rules still answer
+ * for both builds.
  *
- * What this stamp does NOT claim: #2270 captured `waiting` frames only, so the
- * idle (`? for shortcuts`) and generating (spinner) branches are carried over
- * from the 0.4 captures rather than re-measured. A live IDLE 1.1.25 frame is
- * still uncaptured — see the `readIdleEvidence` note in `antigravity/detect.ts`.
+ * What this stamp does NOT claim: the generating (spinner) branch is still
+ * carried over from the 0.4 captures rather than re-measured, and the
+ * post-answer survey (`[1] Good … [0] Skip`) was seen once on the production
+ * server and reconstructed from its cleaned rows — the raw frame is not in the
+ * fixture directory (see its README).
  */
 exports.ANTIGRAVITY_VERIFIED_AGAINST = {
-    version: '1.1.25',
-    capturedAt: '2026-09-04',
+    version: '1.1.27',
+    capturedAt: '2026-09-06',
     paneGeometry: '200x1000',
 };
 /**

package/dist/server/src/lib/history/user-turn-recorder.js

@@ -27,6 +27,17 @@
  * 1. **The key is already on a row** — nothing happens. The callers are pollers,
  *    so being asked to record the same prompt again is the normal case rather
  *    than an error.
+ * 1b. **A RELAY delivery's row already holds this text** (Issue #2392) — the
+ *    same answer, reached without the key. A relay hands session A the reply
+ *    session B wrote by sending it into A's composer, and the row it writes
+ *    carries `relay:<ledgerId>` so that the ledger can be read back out of it
+ *    (#2387). Being keyed is exactly what put it beyond outcome 2's claim, so
+ *    until this Issue every delivery left the operator reading the reply twice.
+ *    The row is recognised here but deliberately **not** claimed: nothing is
+ *    written, its key stays `relay:<ledgerId>`, and the caller is told
+ *    `already-recorded` with that row's id — because re-pointing it at a
+ *    transcript key would take the loop guard's only route back to the ledger
+ *    away with it.
  * 2. **An unkeyed row already holds this text** — that row is *claimed*, not
  *    duplicated. This is the `/send` case, and it is the whole reason the
  *    recorder is not simply an insert: `sendUserMessage` wrote the operator's
@@ -203,37 +214,46 @@ async function recordUserTurn(target, key, content, timestampMs, options = {}) {
     }
 }
 /**
- * Claim the `/send` row for this prompt, if there is one.
+ * Recognise the row this prompt is already on, if there is one.
  *
- * The candidates come back newest first and are compared on normalised content;
- * the one nearest the agent's clock wins, which only matters when the operator
- * sent the same text twice inside the window and is the right tie-break then
- * too.
+ * One window, two kinds of row in it, and what may be done with them differs:
  *
- * The claim itself can lose — `setMessageRequestId` refuses a row that acquired
- * a key between the read and the write. Losing means some other producer got
- * there first, so the next candidate is tried and, if none is left, the caller
- * falls through to the insert. It cannot loop: each attempt either claims a row
- * or removes it from contention.
+ * 1. the `/send` row, which carries no key and is **claimed** — this is #2196's
+ *    case and the reason the recorder is not simply an insert;
+ * 2. a relay delivery's row, which carries `relay:<ledgerId>` and is **left
+ *    exactly as it is** — Issue #2392. `includeRelayDelivered` is what puts it
+ *    in the answer at all, and `requestId` is what tells the two apart.
  *
- * @returns The claimed row, or null when nothing here belongs to this prompt
+ * The claim is tried across every unkeyed candidate first, so the presence of a
+ * delivery cannot cost an orphan row its key. It can lose —
+ * `setMessageRequestId` refuses a row that acquired a key between the read and
+ * the write. Losing means some other producer got there first, so the next
+ * candidate is tried and, if none is left, the delivery is considered and then
+ * the caller falls through to the insert. It cannot loop: each attempt either
+ * claims a row or removes it from contention.
+ *
+ * @returns The row this prompt is on, or null when nothing here is this prompt's
  */
 function adoptExistingRow(chatDb, db, target, instanceId, key, normalized, at, options) {
     // `Math.min` and not a replacement: {@link RecordUserTurnOptions} may widen
     // the search backwards and may never narrow it, so a caller that supplies a
     // bound *inside* the standard window changes nothing.
     const fromMs = Math.min(at - exports.USER_TURN_ADOPTION_WINDOW_MS, options.adoptionFromMs ?? Number.POSITIVE_INFINITY);
-    const candidates = chatDb
-        .findUnkeyedUserMessages(db, {
+    const candidates = sameText(chatDb.findUnkeyedUserMessages(db, {
         worktreeId: target.worktreeId,
         cliToolId: target.cliToolId,
         instanceId,
         fromMs,
         toMs: at + exports.USER_TURN_ADOPTION_WINDOW_MS,
-    })
-        .filter((row) => normalizeUserTurnContent(row.content) === normalized)
-        .sort((a, b) => Math.abs(a.timestamp.getTime() - at) - Math.abs(b.timestamp.getTime() - at));
+        // Issue #2392. Without this the relay delivery's row is not in the answer
+        // at all, and the prompt it holds is inserted a second time.
+        includeRelayDelivered: true,
+    }), normalized, at);
     for (const candidate of candidates) {
+        // A relay delivery, kept for the pass below: claiming it would overwrite the
+        // `relay:<ledgerId>` the loop guard reads the ledger back out of.
+        if (candidate.requestId)
+            continue;
         if (!chatDb.setMessageRequestId(db, candidate.id, key))
             continue;
         logger.info('user-turn-adopted', {
@@ -248,5 +268,48 @@ function adoptExistingRow(chatDb, db, target, instanceId, key, normalized, at, o
             timestampMs: candidate.timestamp.getTime(),
         };
     }
+    // Issue #2392. Nothing is written here and that is the whole point: the row
+    // already says what this prompt says, and its `request_id` is the loop guard's
+    // only way back to the ledger entry that produced it (`findParentRelayHops`,
+    // #2387). So the prompt is reported as recorded on the row that holds it, and
+    // the insert below is not reached. `setMessageRequestId` would refuse the
+    // write anyway — it is a compare-and-set on `request_id IS NULL` — but the
+    // branch above says so explicitly rather than leaning on that.
+    //
+    // No direction test on the timestamp, unlike #2387's `isEchoOfRelayRow`: that
+    // one is deciding whether a row it can already see is an echo, while this is
+    // deciding whether to write a row at all, and a transcript whose clock rounds
+    // a prompt to a whole second would land just *before* the delivery and bring
+    // the duplicate straight back. The symmetric window is safe here because the
+    // text being matched is a relay body — `buildRelayReplyMessage`'s framing, not
+    // anything an operator types.
+    const delivered = candidates.find((candidate) => candidate.requestId);
+    if (delivered) {
+        logger.info('user-turn-already-relayed', {
+            ...describe(target),
+            requestId: key,
+            messageId: delivered.id,
+            relayRequestId: delivered.requestId ?? null,
+            driftMs: delivered.timestamp.getTime() - at,
+        });
+        return {
+            outcome: 'already-recorded',
+            messageId: delivered.id,
+            timestampMs: delivered.timestamp.getTime(),
+        };
+    }
     return null;
 }
+/**
+ * The rows here that hold this prompt's text, nearest the agent's clock first.
+ *
+ * Content is compared normalised, because that is the only comparison
+ * `chat_messages` cannot make for itself (see `findUnkeyedUserMessages`). The
+ * ordering only matters when the same text sits on two rows inside the window,
+ * and nearest-in-time is the right tie-break then too.
+ */
+function sameText(rows, normalized, at) {
+    return rows
+        .filter((row) => normalizeUserTurnContent(row.content) === normalized)
+        .sort((a, b) => Math.abs(a.timestamp.getTime() - at) - Math.abs(b.timestamp.getTime() - at));
+}

package/dist/server/src/lib/hooks/hook-settings-generator.js

@@ -64,6 +64,7 @@ const path_1 = require("path");
 const safe_directory_1 = require("../../config/safe-directory");
 const env_1 = require("../../lib/env");
 const types_1 = require("../../lib/cli-tools/types");
+const model_switch_1 = require("../../lib/hooks/sources/claude/model-switch");
 const tool_id_1 = require("../../lib/hooks/sources/claude/tool-id");
 const permission_request_payload_1 = require("../../lib/hooks/permission-request-payload");
 const logger_1 = require("../../lib/logger");
@@ -343,6 +344,17 @@ function buildSessionStartCommand(target, options = {}) {
  * hook and nothing here delivers it — Claude enforces it itself, before any
  * `PermissionRequest` exists — which is precisely why it belongs next to the
  * hook that Auto-Yes answers rather than in the contract layer above it.
+ *
+ * `PostModelSwitch` (Issue #2363) is the structured report of a `/model` or
+ * `/fast` switch, measured on 2.1.263 to reach a `type: "http"` hook injected
+ * through this very file (`lib/hooks/sources/claude/model-switch` has the
+ * payload). It posts to the event receiver with no matcher: the event fires
+ * only when the model actually changes, so there is nothing to narrow. Its
+ * `PreModelSwitch` twin is deliberately NOT registered — it is a decision hook
+ * whose reply can block the switch, the probe's second session saw it fire
+ * twice per switch with inconsistent `from_model` values, and the `Post` event
+ * alone says what happened. The omission is pinned by
+ * `tests/unit/lib/hooks/hook-settings-post-model-switch-2363.test.ts`.
  */
 function buildAgentHookSettings(target, options = {}) {
     const url = buildAgentEventUrl(target, options);
@@ -369,6 +381,10 @@ function buildAgentHookSettings(target, options = {}) {
             // Issue #1726. The event receiver, not the permission one: observation.
             PreToolUse: [{ matcher: exports.TOOL_USE_MATCHER, hooks: [http()] }],
             PostToolUse: [{ matcher: exports.TOOL_USE_MATCHER, hooks: [http()] }],
+            // Issue #2363. The model the session is now on, on every `/model` and
+            // `/fast` that changes it. Observation, so the event receiver; and only
+            // the `Post` half — see the function comment.
+            [model_switch_1.CLAUDE_POST_MODEL_SWITCH_EVENT_NAME]: [{ hooks: [http()] }],
             // Issue #1724. Points at its own receiver, not the event one.
             PermissionRequest: [{ hooks: [permissionHttp()] }],
         },